2 ms·
Nobody looks good here. The researcher did far more damage than was necessary to demonstrate the vulnerability, and DO’s response sucks.
by SheinhardtWigCo 6y ago
Nobody looks good here. The researcher did far more damage than was necessary to demonstrate the vulnerability, and DO’s response sucks.
- theelous3 6y agoAye, adding a random sample of 10, or probably even just one of those domains which you have manually checked to see it wasn't in legitimate use, would have accomplished the same goal.
- Robin_Message 6y agoI'm not sure that the researcher did any actual damage? I guess they could have taken over one domain to show the vulnerability rather than all of them. But, if anything, they did the work to collate a useful set of abandoned domains, and all DO needed to do was say "thanks, we've moved them to a special account we've set up and sinkholed on our own server". Of course, then DO would be liable for the sinkholing, so maybe they thought it better to lock this guys account ("we did our best to prevent the hacker") and kick the actual issue into the long grass.